江苏盐城盐南、经开17个网站招标信息

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:53 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its bidding-report purpose, but some optional deployment and automation instructions create review-worthy data-sharing and browser-control risks.

Install only if you intend to scrape the listed bidding sites, store results locally, and send reports to Feishu. Review the Feishu destination IDs, avoid putting secrets in shell startup files or committed .env files, disable scheduled pushes unless explicitly needed, and do not deploy the Browser Relay unless it is pinned, authenticated, and bound to a trusted interface.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/openclaw-browser-relay-guide.md:17

Finding

Unpinned Browser Relay Dependencies Permit Mutable Supply-Chain Execution

Content

View full analysis

Remediation

View remediation

``` 5. Verify package signatures, registry provenance, release checksums, and software bills of materials where available. 6. Bind the relay only to localhost unless remote access is explicitly required: ```yaml ports: - "127.0.0.1:8080:8080" ``` 7. Require authentication and request authorization for any endpoint that supports navigation or script evaluation. 8. Run the container as a non-root user with a read-only filesystem, dropped Linux capabilities, resource limits, and only the minimum required mount. 9. Clearly mark the relay as optional and retain the direct API crawler as the default workflow. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/pdf_generator.py:716

Finding

Untrusted Scraped Values Are Embedded Directly into ReportLab Markup

Content

View full analysis

{url}', link_style ) else: link_para = Paragraph('-', link_style) table_data.append([ Paragraph(project['source_site'], cell_style), Paragraph(project['publish_date'], cell_style), title_para, link_para ]) ``` A second report-generation path repeats the same unsafe construction: ```python url = project['detail_url'] or '' name_para = Paragraph(project['project_name'], cell_style) if url: link_para = Paragraph( f"{url}", link_cell_style ) else: link_para = Paragraph('-', link_cell_style) table_data.append([ Paragraph(project['source_site'], cell_style), Paragraph(project['publish_date'], cell_style), name_para, link_para ]) ``` ### Technical Analysis ReportLab `Paragraph` values are parsed as XML-like rich-text markup rather than rendered as literal text. The affected values originate from remote bidding websites, are stored in the local database, and are later passed directly to `Paragraph` or interpolated into a `link` element. The implementation does not escape markup metacharacters in project names, source-site names, dates, or displayed URLs. It also places the URL directly inside a quoted `href` attribute without attribute encoding or scheme validation. An attacker controlling a source listing could supply characters such as quotes, angle brackets, or ReportLab-supported tags. Crafted content could terminate the intended attribute or element, ...[truncated 1879 chars]

Remediation

View remediation

' f'{safe_label}', link_cell_style ) else: link_para = Paragraph('-', link_cell_style) ``` 6. Apply the same encoding helper consistently to both daily and monthly report paths. 7. Add tests containing quotes, angle brackets, ampersands, nested tags, control characters, and prohibited URL schemes. 8. Consider recording the original source value separately from a normalized display value, while treating both as untrusted whenever they cross into a markup interpreter. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (57)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A description-behavior mismatch is security-relevant because users and orchestrators may grant trust based on the declared purpose while the actual workflow also includes broader collection, persistence, logging, snapshots, or transmission behaviors. That mismatch weakens informed consent and can conceal data handling that would otherwise require stricter review.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A description-behavior mismatch is security-relevant because users and orchestrators may grant trust based on the declared purpose while the actual workflow also includes broader collection, persistence, logging, snapshots, or transmission behaviors. That mismatch weakens informed consent and can conceal data handling that would otherwise require stricter review.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/PDF报告生成与飞书推送使用指南.md (reported line 333)May include surrounding context.

配置文件示例

bash

# .env 文件
FEISHU_WEBHOOK_URL=https://open.feishu.cn/open-apis/bot/v2/hook/xxxxxxxxxxxxxxxxxxxxxxxx
FEISHU_APP_ID=cli_xxxxxxxxxxxxxxxx
FEISHU_APP_SECRET=xxxxxxxxxxxxxxxxxxxxxxxx

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/openclaw-browser-relay-guide.md (reported line 79)May include surrounding context.

3. 关闭会话

bash

DELETE /sessions/:sessionId

使用示例

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/飞书企业自建应用配置指南.md (reported line 93)May include surrounding context.

点击"复制群ID"或"查看群信息"

• 记录 open_chat_id

---

第四步：配置环境变量

1. 设置环境变量

方式1：临时设置（终端）

bash

export FEISHU_APP_ID="cli_xxxxxxxxxxxxxxxx"
export FEISHU_APP_SECRET="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
export FEISHU_CHAT_ID="oc_xxxxxxxxxxxxxxxx"

方式2：永久设置（~/.bashrc 或 ~/.zshrc）

bash

echo 'export FEISHU_APP_ID="cli_xxxxxxxxxxxxxxxx"' >> ~/.bashrc
echo 'export FEISHU_APP_SECRET="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"' >> ~/.bashrc
echo 'export FEISHU_CHAT_ID="oc_xxxxxxxxxxxxxxxx"' >> ~/.bashrc
source ~/.bashrc

方式3：使用 .env 文件

bash

# 创建 .env 文件
cat > .env << EOF
FEISHU_APP_ID=cli_xxxxxxxxxxxxxxxx
FEISHU_APP_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
FEISHU_CHAT_ID=oc_xxxxxxxxxxxxxxxx
EOF

# 加载环境变量
export $(cat .env | xargs)

方式4：Python代码中设置

python

import os
os.environ['FEISHU_APP_ID'] = 'cli_xxxxxxxxxxxxxxxx'
os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Using a local .env file to store application credentials creates a realistic credential exposure path if the file is committed to version control, copied in backups, or read by other users or processes on the host. Because the secret enables authenticated API access, compromise could allow unauthorized messaging or file operations in Feishu.

Content

Scanner excerpt · references/飞书企业自建应用配置指南.md (reported line 99)May include surrounding context.

source ~/.bashrc

text

**方式3：使用 .env 文件**
```bash
# 创建 .env 文件
cat > .env << EOF

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

This line places the Feishu App Secret directly into a plaintext .env file example, normalizing unsafe secret handling without strong warnings. If reused by operators, the credential may be exposed through repository commits, local compromise, or operational mishandling, enabling unauthorized API access.

Content

Scanner excerpt · references/飞书企业自建应用配置指南.md (reported line 101)May include surrounding context.

方式3：使用 .env 文件

bash

# 创建 .env 文件
cat > .env << EOF
FEISHU_APP_ID=cli_xxxxxxxxxxxxxxxx
FEISHU_APP_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

This continues the insecure .env credential storage pattern by showing sensitive configuration grouped in a plaintext file. Even though the chat ID is less sensitive than the App Secret, colocating identifiers and secrets makes accidental disclosure more useful to an attacker.

Content

Scanner excerpt · references/飞书企业自建应用配置指南.md (reported line 102)May include surrounding context.

方式3：使用 .env 文件

bash

# 创建 .env 文件
cat > .env << EOF
FEISHU_APP_ID=cli_xxxxxxxxxxxxxxxx
FEISHU_APP_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
FEISHU_CHAT_ID=oc_xxxxxxxxxxxxxxxx

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The command export $(cat .env | xargs) encourages bulk-loading secrets from a plaintext file and can expose them to shell history, process environments, child processes, and debugging output. It also promotes unsafe parsing behavior for values containing special characters or spaces.

Content

Scanner excerpt · references/飞书企业自建应用配置指南.md (reported line 109)May include surrounding context.

EOF

加载环境变量

export $(cat .env | xargs)

text

**方式4：Python代码中设置**

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill document instructs execution of local Python scripts, filesystem access, database writes, network scraping, and outbound Feishu delivery, but it declares no explicit tool scope or permission boundaries. In an agent environment, this can enable over-privileged execution and make it easier for the skill to read, write, or transmit data beyond what a user reasonably expects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description omits a clear warning that it persists scraped data locally and can transmit generated reports to external recipients. Without explicit notice, users may unknowingly authorize retention and exfiltration of potentially sensitive procurement data or derived reports.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger scenario is broad enough that an agent may invoke a skill that performs scraping, storage, PDF generation, and message delivery in situations where the user only asked for monitoring or general information. Overbroad activation criteria increase the chance of unintended network access, local data changes, and external sharing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The cron section describes unattended daily collection, report generation, and automatic group push without an explicit user warning or consent boundary. Automatic recurring outbound actions are more dangerous than one-off actions because they can continuously disclose data, amplify mistakes, and be harder for users to notice.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The example explicitly uploads a generated report file to Feishu and then sends it to a chat, which is a real outbound data exfiltration path to a third-party cloud service. Even if intended for normal business use, the file may contain sensitive procurement details, and the documentation does not mention data classification, approval, redaction, or destination validation safeguards.

Content

Scanner excerpt · references/PDF报告生成与飞书推送使用指南.md (reported line 118)May include surrounding context.

md

)

# 上传文件
file_key = api.upload_file('./招投标数据/daily/招投标信息日报_2026-04-12.pdf')

# 发送文件消息
api.send_file_message('oc_xxxxxxxxxxxxxxxx', file_key)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide describes a workflow that automatically writes PDF files to disk, pushes content to Feishu, and updates push status in records, but it does not clearly warn operators that these are side-effecting actions involving local persistence, external data transmission, and state mutation. In an agent skill context, insufficient disclosure can cause unintended data handling or outbound sharing, especially when users may assume the operation is read-only reporting.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide exposes a generic remote browser execution interface that supports arbitrary actions and raw JavaScript via '/execute', which goes beyond the stated bidding-information collection purpose. If deployed without strong access controls, an attacker could drive browser sessions, access internal web apps reachable from the host, exfiltrate data, or abuse the service as a general-purpose web automation pivot.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation normalizes a service that can remotely execute browser actions and arbitrary JavaScript without any warning about authentication, network exposure, sandboxing, or data access risks. In the context of a crawler skill, this is more dangerous because operators may deploy it as supporting infrastructure and unintentionally expose a powerful browser-control endpoint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document explicitly recommends anti-crawling bypass measures such as using random User-Agent values, proxy IPs, and Playwright to work around WAFs and interception. In the context of a scraping skill, this operational guidance can enable unauthorized circumvention of target-site protections and create legal, compliance, and abuse risk, especially because it is presented as implementation advice without guardrails or authorization requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The guide instructs users to upload PDF reports and send messages through Feishu, which transmits potentially sensitive report contents to an external platform. Although this is the feature's intended purpose, the document does not prominently warn users about data disclosure, recipient scope, or the need to classify report contents before upload, increasing the risk of unintentional data exfiltration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document recommends storing App Secret values in shell startup files, .env files, and even directly in Python code, but does not prominently explain the risks of secret leakage through source control, shell history, process inspection, backups, or multi-user host access. This can lead to credential compromise and unauthorized use of the Feishu application.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 55% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/飞书企业自建应用配置指南.md (reported line 142)May include surrounding context.

md

from scripts.feishu_enterprise_app import FeishuEnterpriseApp

app = FeishuEnterpriseApp()
file_key = app.upload_file('./招投标_data/daily/招投标信息日报_2026-04-12.pdf')

if file_key:
    print(f"✅ 文件上传成功: {file_key}")

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 55% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/飞书企业自建应用配置指南.md (reported line 161)May include surrounding context.

md

from scripts.feishu_enterprise_app import FeishuEnterpriseApp

app = FeishuEnterpriseApp()
file_key = app.upload_file('./招投标_data/daily/招投标信息日报_2026-04-12.pdf')

if file_key:
    print(f"✅ 文件上传成功: {file_key}")

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 76% confidence

Finding

The example explicitly uploads a generated PDF report to Feishu via an external API, which is a form of outbound data transfer. While this appears to be intended product functionality rather than malicious behavior, it still represents a true exfiltration channel because local report files can be sent outside the system boundary to third-party infrastructure.

Content

Scanner excerpt · references/飞书推送配置说明.md (reported line 82)May include surrounding context.

md

api = FeishuOpenAPI()

   # 上传文件
   file_key = api.upload_file("./招投标数据/daily/招投标信息日报_2026-04-12.pdf")

   # 发送文件消息
   api.send_file_message(chat_id, file_key)

Static analysis

No suspicious patterns detected.